For the following example has been granted read-only access to the file system. It cannot write to the file system, or perform any other security sensitive functions.

The following permissions are available:

• —allow-env=\ Allow environment access for things like getting and setting of environment variables. Since Deno 1.9, you can specify a optional, comma-separated list of environment variables to provide an allow-list of allowed environment variables.
• —allow-hrtime Allow high-resolution time measurement. High-resolution time can be used in timing attacks and fingerprinting.
• —allow-net=\ Allow network access. You can specify an optional, comma-separated list of IP addresses or hostnames (optionally with ports) to provide an allow-list of allowed network addresses.
• —allow-ffi Allow loading of dynamic libraries. Be aware that dynamic libraries are not run in a sandbox and therefore do not have the same security restrictions as the Deno process. Therefore, use with caution. Please note that —allow-ffi is an unstable feature.
• —allow-read=\ Allow file system read access. You can specify an optional, comma-separated list of directories or files to provide an allow-list of allowed file system access.
• —allow-write=\ Allow file system write access. You can specify an optional, comma-separated list of directories or files to provide an allow-list of allowed file system access.
• -A, —allow-all Allow all permissions. This disables all security.

Deno allows you to control the granularity of some permissions with allow-lists.

File system access

This example restricts file system access by allow-listing only read access to the /usr directory. In consequence the execution fails as the process was attempting to read a file in the /etc directory:

$ deno run --allow-read=/usr https://deno.land/std@$STD_VERSION/examples/cat.ts /etc/passwd
error: Uncaught PermissionDenied: read access to "/etc/passwd", run again with the --allow-read flag
► $deno$/dispatch_json.ts:40:11
    at DenoError ($deno$/errors.ts:20:5)
    ...

deno run --allow-read=/etc https://deno.land/std@$STD_VERSION/examples/cat.ts /etc/passwd

--allow-write works the same as --allow-read.

Network access

This is an example of how to allow-list hostnames, ip addresses, optionally locked to a specified port:

# Multiple hostnames, all ports allowed
deno run --allow-net=github.com,deno.land fetch.js
# A hostname at port 80:
# An ipv4 address on port 443
deno run --allow-net=1.1.1.1:443 fetch.js
# A ipv6 address, all ports allowed
deno run --allow-net=[2606:4700:4700::1111] fetch.js

If tries to establish network connections to any hostname or IP not in the allow-list, the relevant call will error.

deno run --allow-net fetch.js

Environment variables

This is an example of how to allow-list environment variables:

# Allow all environment variables
deno run --allow-env env.js
# Allow access to only the HOME env var
deno run --allow-env=HOME env.js

Subprocess permissions

Subprocesses are very powerful, and can be a little scary: they access system resources irregardless of the permissions you granted to the Deno process that spawns them. The cat program on unix systems can be used to read files from disk. If you start this program through the Deno.run API it will be able to read files from disk even if the parent Deno process can not read the files directly. This is often reffered to as privledge escalation.

Because of this, make sure you carefully consider if you want to grant a program --allow-run access: it essentially invalidates the Deno security sandbox. If you really need to spawn a specific executable, you can reduce the risk by limiting which programs a Deno process can start using an allow-list for the --allow-run flag:

const proc = Deno.run({ cmd: ["cat", "/etc/passwd"] });

Permission flags where explained by Ryan Dahl in his 2020 talk about the Deno security model at Speakeasy JS: